{"affected":[{"defaultStatus":"unaffected","product":"BuddyBoss App","source":"CNA: Wordfence","vendor":"BuddyBoss","versions":[{"lessThanOrEqual":"3.2.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-76124","cwes":["CWE-434"],"description":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793709114695,"publishedAt":1793709114695,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/"}],"remediation":[],"revision":"1ee6a02fe5c71bc933d6bfee8c5f965be1863c5ebf7f648d87df5c9c16ecded4","sources":[{"modifiedAt":1793709114695,"name":"CNA: Wordfence","retrievedAt":1793711393218,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76124"}],"ssvc":null,"status":"published","title":"BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint","updatedAt":1793711393218}